AI in US local government: are your prompts public records?

If you work for a city or a county and paste a resident’s email into a chatbot, two copies now exist. One sits with the vendor. The other is a record that anyone in your state can ask to see. In Washington, people asked, and cities released thousands of pages of staff chats.

This guide is for the records officer and the employee at the counter. They need to know what to keep and what a requester can get, and both answers change at the state line. So I show where they change instead of pretending fifty states share one rule.

Are ChatGPT prompts public records? What two Washington cities released

Cascade PBS and KNKX asked nearly a dozen Washington cities for two years of staff ChatGPT histories, some going back to 2023. Bellingham and Everett answered fastest and most completely. The reporters say that speed is the only reason the stories center on those two cities.

The logs read like any office’s week. A mayor’s letter backing a Lummi Nation grant application matched the chatbot’s output in about half its sentences. A staffer pasted a senior citizen’s email about unaffordable utility bills and asked for a sympathetic reply.

The machine writing worries me less than the table below. Nobody had told those employees the chat window was a filing cabinet with a public counter. The vendor’s side of the same paste is covered in what ChatGPT does with what you type.

Public records law by state: same prompt, different rules

Every public records act I read for this page defines a record by content and purpose, never by software, which is why a chatbot falls inside. What moves from state to state is the deadline, the exemption list, the retention schedule and how courts treat private phones and vendors’ servers.

Pick your state below. I chose seven where I could open the statute or a ruling myself; if yours is missing, ask the same four questions of your own law. The consumer privacy statutes, written around businesses, are a different layer, mapped in our state-by-state guide.

Personal ChatGPT accounts don’t take a chat out of a records request

The commonest workaround in city hall is the employee who pays for a personal subscription because IT hasn’t approved anything. Courts closed that door before chatbots existed, with email and text messages, and nothing about a chat window reopens it.

Washington’s Supreme Court held in 2015 that texts a public employee sends in an official capacity belong to the agency even on a private phone. California’s Supreme Court said the same of personal accounts in 2017. Both courts accepted the same mechanics, and those mechanics are what an employee should expect.

Bellingham’s mayor told reporters her chats weren’t released because she hadn’t been logged in, so nothing was saved, and she called that use transitory. A chat never saved can’t be produced. Deleting one after a request arrives is a different act, and a deleted ChatGPT chat cannot be brought back.

In Washington, RCW 42.56.100 forbids destroying a requested record until the request is resolved, even one already scheduled for destruction. Florida’s 119.07(1)(h) holds a record for 30 days after a written request even when the custodian says it isn’t public.

I would put both rules in every onboarding pack, because the instinct to tidy up a chat history is strongest exactly when someone asks for it.

AI records retention: when a chat is transitory and when it isn’t

Washington’s State Archives answers retention with a refusal: there is no single period for AI records, because content and function set retention, not format. A chatbot used as a sounding board can go under the transitory Brainstorming and Collaborating series. One used to develop an ordinance goes under the ordinance’s series.

King County, under the same state law, put numbers on it in October 2026. Its approved tool, Copilot Chat, keeps chats for 30 days, a setting chosen because most AI use is assumed transitory. The county says outright that this storage setting is not a legal retention requirement.

Texas’s State Library reaches the same place from another door: classify an AI-assisted record as you would a human one. A press release drafted with AI is a press release. For staff training I prefer this framing, since nobody has to learn a new category.

One detail from the county’s export steps is worth passing on: its Export to Word option keeps the answers and leaves out the prompts. If the prompt is part of the record, copy it by hand.

Can your employer see your ChatGPT prompts? Admin exports and the vendor’s copy

On a managed work account, an administrator can usually search and export history, which is exactly what a records officer needs. On a free consumer account, the only copy may sit on the vendor’s servers. Commercial terms differ from consumer ones too, as Claude’s plans show.

Does the vendor’s copy count as yours? North Carolina’s Court of Appeals answered for a different tool in 2023. Survey answers held only on a consultant’s servers were Charlotte’s public records, because the contract let the city demand the data in machine-readable form. That right was enough; the city never needed a copy in hand.

My reading for an AI contract: an export right is a duty in disguise, so test it before you need it. Seattle’s policy already makes departments responsible for searching for and retrieving AI records when a request comes in.

Several of these questions also appear on insurers’ renewal forms, listed in the cyber questionnaire guide.

If your own software reaches a model through a gateway, its logs can be records as well; our AI gateway guide explains what those logs hold.

Redacting AI chat logs: exemptions are narrower than “sensitive”

Bellingham’s and Everett’s records officers did redact some chats: encampment-tracking code, an active police investigation. But the reporting adds that many records failed the legal threshold for redaction and still carried personal information never meant for the public. That gap is where residents get hurt.

The exemptions are your state’s, not FOIA’s. FOIA’s nine bind only federal agencies, since the statute defines an agency as an authority of the US government. Florida, for example, requires the custodian to redact only the exempt part, produce the rest and cite the statute for each cut.

I would not let anyone treat “embarrassing” or “private” as grounds to withhold; neither is an exemption on its own. And when the copy goes out as a PDF, a black box drawn over a name doesn’t remove it.

Redaction for litigation runs on different rules; which American rules care what you removed covers that side.

What never to paste into AI: a never list by department

Bellevue’s AI policy says it in one line: confidential and sensitive information may not go into any AI software without an approved exception, and that includes legally protected personal or employee data. It’s a sound rule, and it still leaves a caseworker guessing what counts at eight in the morning.

Washington’s state guidance pushes further for state employees. WaTech’s 2023 interim guidelines read the ethics law’s ban on disclosing confidential information “to any person” as covering commercial AI tools. On that reading the paste is the disclosure, the same logic a firm faces in whether a paste is a breach.

So write the list in your departments’ own words. One address on one date identifies a household with no name attached, which is why a list of what to remove before AI has to cover combinations, not only numbers.

The permit counter can also help applicants protect themselves. Someone sending ID by email can watermark a passport card copy for the permit office before it lands in a city inbox.

The same goes for a license: applicants can watermark the license copy with the office’s name and the date, so a stray copy says where it was meant to go.

Answering a resident’s email with AI, minus the resident

Take the snowplow complaint. Asking a chatbot for a short, polite reply is a fair use. The model needs the substance and what the city did. It doesn’t need her name, her email address or her block.

Somebody still has to read her email and the draft before it goes. A canned answer to a complaint is its own small failure, whatever tool wrote it. That habit holds whichever assistant the city licenses, Gemini included.

Before pasting a draft, you can check it here for the identifiers that have a fixed shape.

Where city software calls a model directly, the same cut can happen in code. Inside a Kong deployment, Kong’s AI Sanitizer plugin swaps personal data for placeholders.

For applications that call the OpenAI API, PII redaction for the OpenAI API can run on the city’s own servers before each request leaves.

A public records chatbot on the city website

People reach this page searching for an AI chatbot for public records questions. A bot facing residents carries a different risk from staff drafting: it answers in the city’s name, and every conversation it holds is a record. Texas’s State Library files a customer service bot’s replies under General Correspondence.

New York City showed the first risk. In 2024 The Markup found its MyCity bot telling businesses they could refuse cash and keep a cut of workers’ tips. The city took it down on February 4, 2026, after Mayor Zohran Mamdani called it functionally unusable.

A bot that tells residents what the law allows is a publication, so the sign-off belongs with the city attorney as much as with IT.

IT still has a job on the input side: a screening API such as Lakera Guard checks each incoming message for prompt injection.

City AI policy: the records clauses that usually go missing

Seattle’s AI policy, POL-211, approved May 6, 2025, carries three lines a records officer should borrow. Content sets retention. Anything responsive to a request is disclosed regardless of its retention period. Departments must search for and retrieve AI records. The US policy layer adds the state laws.

Labeling clauses are where cities slip. Everett told staff in July 2024 to label AI material released for public policy decisions, and records show unlabeled AI content afterward, including the mayor’s letter to Congress. A narrow rule that people follow beats a broad one they don’t, which the general template keeps short.

Everett also sent its draft to the employee unions before the mayor approved it. A policy that can discipline people is often a bargaining subject. What insurers make of AI use is in what cyber insurance doesn’t cover.

Before the next records request reaches your inbox

Most of this page can be borrowed from another city. The never list can’t. If your department heads can give it one afternoon, spend the whole afternoon on that list.

A redaction step on each desk makes the never list easier to keep: SSNs and other American identifiers become placeholders before a prompt leaves, you can undo any of them on screen, and what puts them back stays on the employee’s computer. If that suits your office, see what Nonimo does for US teams.

The text is redacted on the computer and doesn’t reach Nonimo; the security page has the detail.

For a rollout across several departments, our channel partners are where that conversation starts.

Sources

• Managing Generative AI Records, Washington State Archives. AI input and output as public records, personal accounts included.
• How Long Do Generative AI Records Need to Be Kept?, Washington State Archives, June 2024. Content and function, the transitory series, “a strategy for chaos”.
• Records Management Guidance: Generative AI, King County, 10/2026. The 30-day Copilot Chat setting, simplified periods, export steps.
• Open the Pod Bay Doors: public records and generative AI, MRSC, July 29, 2024. Prompts as likely records and RCW 42.56.100.
• AI policies and resources for local governments, MRSC. HB 1170 and its February 1, 2027 start.
• City of San Jose v. Superior Court, S218066, Supreme Court of California, March 2, 2017. Personal accounts, and its discussion of Nissen v. Pierce County.
• Legislative update, September 30, 2026, Office of the Governor of California. AB 1821, on CPRA response time, signed.
• Section 119.07, Florida Statutes, Florida Legislature. Prompt acknowledgment, partial redaction, citing the exemption, the 30-day hold.
• Generative AI and the Public Records Act, UNC School of Government. North Carolina’s reading and Gray Media v. City of Charlotte.
• Classifying AI-Generated Records, Texas State Library and Archives Commission, June 10, 2024.
• HB 149, enrolled text, Texas Legislature. Sections 552.003 and 552.051, effective January 1, 2026.
• Artificial Intelligence Policy POL-211, City of Seattle, approved May 6, 2025.
• AI Policy, City of Bellevue. Records and the ban on confidential and sensitive inputs.
• Washington city officials are using ChatGPT for government work, Cascade PBS and KNKX, August 26, 2025.
• Washington cities’ AI policies play catch-up, Cascade PBS and KNKX, August 27, 2025.
• Mamdani to kill the NYC AI chatbot, The Markup and THE CITY, January 30, 2026, updated February 4, 2026.
• Public Officers Law section 89, New York State Senate. FOIL response deadlines.
• 5 U.S.C. 551, Legal Information Institute. The definition of agency that FOIA uses.

Statutes read without a link: RCW 42.56; Cal. Gov. Code 7920.530 and 7922.535; Tex. Gov. Code 552; C.R.S. 24-72; N.C.G.S. 132-6. Rulings: Nissen v. Pierce County (Wash. 2015); Gray Media v. City of Charlotte (N.C. Ct. App. 2023).

Checked on November 7, 2026.